CVE-2025-34187CWE-269CWE-78

Ilevia EVE X1/X5 Server 4.7.18.0.eden Reverse Rootshell

Critical · published September 16, 2025

CVSS v4.0
9.3
EPSS
3%
Percentile
87.9
In the wild
Unconfirmed
What it is

Ilevia EVE X1/X5 Server version ≤ 4.7.18.0.eden contains a misconfiguration in the sudoers file that allows passwordless execution of certain Bash scripts. If these scripts are writable by web-facing users or accessible via command injection, attackers can replace them with malicious payloads. Execution with sudo grants full root access, resulting in remote privilege escalation and potential system compromise.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.03161 · 87.9th percentile
Weaknesses
CWE-269 · Improper Privilege Management; CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2025-09-16T19:45Z
EPSS history
Timeline
  • 16 SEP 19:45Z
    Ilevia EVE X1/X5 Server 4.7.18.0.eden Reverse Rootshell
    cvelistv5